EepGet: Refuse attempted redirect to HTTPS, won't work

2017-11-21 00:58:44 +00:00
parent 173823695f
commit 07a83bf310
1 changed files with 2 additions and 0 deletions
--- a/core/java/src/net/i2p/util/EepGet.java
+++ b/core/java/src/net/i2p/util/EepGet.java
@@ -720,6 +720,8 @@ public class EepGet {
            try {
                if (_redirectLocation.startsWith("http://")) {
                    _actualURL = _redirectLocation;
+                } else if (_redirectLocation.startsWith("https://")) {
+                    throw new IOException("Redirect to https unsupported");
                } else { 
                    // the Location: field has been required to be an absolute URI at least since
                    // RFC 1945 (HTTP/1.0 1996), so it isn't clear what the point of this is.